All Apps and Add-ons

NetApp syslog truncated


I'm working with the Splunk TA ONTAP 2.1.7 and the NetApp A400 AFF.  The syslog-ng farm we have is receiving the syslog events being sent from the NetApp.  Two problems.  First is the messages don't look like what is in the sample files.

Mar 3 19:44:28 NetApp: NetApp: hex_digits_1.hex_digits_2 hex_digits_3 Wed Mar 03 2021 11:44:27 -08:00 [kern_audit:info:9521] hex_digits4 :: NetApp:http :: :: NetApp:CS\script :: GET /spi/NetApp/etc/log/stats/ccma/kernel/opm/078029_000300_1614800101000_0239077.ccma.gz HTTP/1.1 :: Success: 200 OK
7-mode samples
Dec 9 09:48:53 Dec 9 09:44:45 [cluster07:kern.syslogd.restarted:info]: syslogd: Restarted. ","",ontap,"udp:514","ontap:syslog","2016-12-09 09:48:53"
Dec 9 09:53:06 Dec 9 09:48:58 [cluster07:iscsi.notice:notice]: ISCSI: New session from initiator at IP addr
","",ontap,"udp:514","ontap:syslog","2016-12-09 09:53:06"
C-mode samples
Dec 9 11:21:35 Dec 9 11:22:01 [crest-cluster01-01:raid.rg.media_scrub.done:notice]: /aggr1/plex0/rg0: media scrub completed in 23:57.00 ","",ontap,"udp:514","ontap:syslog","2016-12-09 11:21:35"
Dec 9 11:23:39 Dec 9 11:21:04 [crest-cluster01-01:raid.rg.media_scrub.start:notice]: /aggr1/plex0/rg0: start media scrub ","",ontap,"udp:514","ontap:syslog","2016-12-09 11:23:39"
The 7 and C modes don't look anything like the syslog events that are in the syslog-ng.  The second issue is the messages are being truncated.
Mar 3 20:11:04 NetApp NetApp: NetApp: hex_digits_1.hex_digits_2 hex_digits_3 Wed Mar 03 2021 12:11:04 -08:00 [kern_audit:info:1817] hex_digits_4 :: NetApp:ontapi :: :: NetApp:DC\script :: <netapp version='1.0' xmlns='' nmsdk_version='9.5' nmsdk_platform='Windows Server 2016' nmsdk_language='Java'><diagnosis-alert-get-iter><query><diagnosis-alert-info><monitor>system-connect|node-connect</monitor><subsystem>FHM-Switch|metrocluster_node|metrocluster|fhm-bridge|sas_connect</subsystem><alert-id>InterclusterBrokenConnectionAlert|InterconnectAdapterOfflineAlert|RaidDegradedMirrorAggrAlert|RaidLeftBehindAggrAlert|RaidLeftBehindSpareAlert|StorageFCAdapterFault_Alert|ClusterSeveredAllLinksAlert|NoISLPresentAlert|FabricSwitchFanFail_Alert|FabricSwitchPowerFail_Alert|FabricSwitchTempCritical_Alert|FabricSwitchUnreachable_Alert|StorageBridgePortDown_Alert|StorageBridgeTempAboveCritical_Alert|StorageBridgeTempBelowCritical... :: Pending:
The above contains incomplete XML.  We have proved to ourselves that the listening port can take longer messages so the thought is the message is truncated at the sender.
If anyone has any ideas about why the messages don't look similar, I don't control the NetApp only Splunk, or why the messages get truncated, please let me know.
Splunk : 7.3.6
OS : Red Hat Enterprise Linux release 8.3 (Ootpa)
Labels (1)
0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...

We’ve Got Education Validation!

Are you feeling it? All the career-boosting benefits of up-skilling with Splunk? It’s not just a feeling, it's ...